Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dajomas
dajomas
Path Finder
Member since:
04-25-2016
09-10-2023
Community Statistics
| Posts | 29 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 7 |
| Member Since | 04-25-2016 |
Activity Feed
- Posted How can I index data from a CSV file with 2 header lines on Getting Data In. 09-10-2023 05:00 AM
- Tagged How can I index data from a CSV file with 2 header lines on Getting Data In. 09-10-2023 05:00 AM
- Tagged How can I index data from a CSV file with 2 header lines on Getting Data In. 09-10-2023 05:00 AM
- Tagged How can I index data from a CSV file with 2 header lines on Getting Data In. 09-10-2023 05:00 AM
- Posted Re: How do I plot a 3d height/terrain map on Dashboards & Visualizations. 02-01-2023 06:00 AM
- Posted How do I plot a 3d height/terrain map? on Dashboards & Visualizations. 01-31-2023 11:45 PM
- Tagged How do I plot a 3d height/terrain map? on Dashboards & Visualizations. 01-31-2023 11:45 PM
- Tagged How do I plot a 3d height/terrain map? on Dashboards & Visualizations. 01-31-2023 11:45 PM
- Tagged How do I plot a 3d height/terrain map? on Dashboards & Visualizations. 01-31-2023 11:45 PM
- Posted Re: Dashboard search "eval" token returns wrong result, same code gets right answer when run in search window on Dashboards & Visualizations. 07-04-2022 08:41 AM
- Posted Re: Dashboard search "eval" token returns wrong result, same code gets right answer when run in search window on Dashboards & Visualizations. 07-03-2022 02:10 AM
- Got Karma for Re: What meant by a silent installation of Splunk on Linux, and how do you do it?. 06-27-2022 02:10 AM
- Got Karma for Re: Slack alert not sending?. 06-05-2020 12:50 AM
- Karma Re: Using trellis with simple XML extension for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the Http event collector not visible in UI?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the Http event collector not visible in UI?. 06-05-2020 12:49 AM
- Got Karma for Re: Using trellis with simple XML extension. 06-05-2020 12:49 AM
- Karma After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Karma Re: After upgrading to 6.5.0, KV Store will not start for jcrabb_splunk. 06-05-2020 12:48 AM
- Karma Re: How to find blocks where response time is 0 from ping data? for somesoni2. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-10-2023
05:00 AM
Hi all, I have CSV files (they are exports from the Garmin R10 launch monitor session data via the Garmin Golf app) that contain 2 header lines, the first header line contains the field names and the second header line contains the unit of measurement (or blank if not applicable) For example: Date,Player,Club Name,Club Type,Club Speed,Attack Angle,... ,,,,[mph],[deg],... 09/10/23 10:00:45 AM,Johan,7 Iron,7 Iron,70.30108663634557,-7.360383987426758,... Now, I would like to index the data in one of 2 ways: Add the unit of measurement to the value so that would become "70.30108663634557mph" for the Club Speed field Add an additional column that contains the unit of measurement Add column "Club Speed UOM" with value mph for every line indexed from the CSV file and do this for every column that contains a valid unit of measurement For me, option 2 would be the preferred option A third option, would be to skip the unit of measurement line altogether but I would rather not use this option. I would appreciate any help that points me in the right direction to solve this challenge. Thanx in advance.
... View more
Labels
- Labels:
-
CSV
02-01-2023
06:00 AM
Yes, I have seen that one, but there is no way to connect the dots into a height/terrain map unfortunately
... View more
01-31-2023
11:45 PM
Hello all,
I have a data set in Splunk from which I can extract X, Y and Z values that I need to plot into a 3D height or terrain map. I have been searching for a bit but so far, I have been unable to find a solution. (Which may also mean that I am not a good searcher...)
Can anyone point me in the right direction on how I can get a nice 3D graph like that in my dashboard? (I am currently on Splunk 9.0.3 but I keep my version up-to-date)
Thanx in advance.
... View more
07-04-2022
08:41 AM
Unfortunately, there is this weird thing, where it DOES work on my mobile but not on my laptop (using Chrome) Thing is, I use a drilldown in a bar graph to set the year and month for another bar graph (first bargraph is a monthly total for a given year, second bar graph is a daily total for a given month. When you click on a specific month, it shoul show that month in the second bar graph, but it show a month earlier. Same for a third graph that shows a specific day, which you can select by clicking on a date in the second bargraph.) Now, when I open the search in a separate window and I add the exact same evals which are used in the dropdown, the correct values are shown. But when I click in the graph, the wrong values are used (the values from 1 bar to the left)
... View more
07-03-2022
02:10 AM
@gabriel_vasseur did you ever get this issue fixed? My dashboard just started to show the same issue after it ran ok for over a week. (Running Splunk 9.0.0)
... View more
07-29-2019
01:26 PM
1 Karma
@nick405060 Hi there,
unfortunately, I haven't been working with Splunk a lot and to my shame, the Slack alert app has been slipping a bit.
I will have to dig into the reason why I had the message field mandatory and if that's the case, why it doesn't warn when it is actually empty.
Might well be a bug. But I can't say right now.
I will keep you posted.
Best regards,
Johan
... View more
10-23-2018
11:26 PM
2 Karma
I found the culprit!
I don't know how or when it happened but in my role, the "edit_token_http" capability was disabled.
After I (re-)enabled it, the HTTP Event Collector was available again in the Data Inputs screen
... View more
10-23-2018
01:30 AM
I have the same issue. I have removed every (yes every) app I installed but to no avail. I also made sure that Index Clustering and Distributed Search was disabled. But alas, no HTTP Event Collector is available in my Data Inputs.
I am running Splunk 7.2.0 Enterprise on Centos 7.5
In the past, I was able to configure HEC and they are still running and active but without the option in Data Inputs, I cannot manage them nor add or delete them via the Splunk UI
(When I do a clean install, there is no issue but migrating is not my preferred choice)
Does anybody have a tip on where to look to fix this issue?
... View more
05-04-2018
06:05 AM
@biswabhusan yes, you run this on the search head
... View more
01-10-2018
05:25 AM
Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!
... View more
12-14-2017
07:22 AM
I downvoted this post because yes, it splits a string into a multiline field but this does not give me the required result in the annotation_label. if i set annotation_label to a multiline value, there is simply no annotation_label in the chart. there is only an annotation line at the _time value
... View more
12-14-2017
05:02 AM
I would like to put a text in the annotation_label, in a line chart, that has multiple lines.
Adding <BR> (using "& lt ;" and "& gt ;" (without spaces) ) or \n puts that text literally in the label and & #13;& #10; or & #10; (without spaces after &) just puts in a space
For instance:
| eval Value = "Value"
| eval annotation_label = Value . "< BR>" . Value . "\n" . Value
Results in the following tekst in the label (The space before BR is just to ensure the characters are shown correctly in this request. I don't have it in the real search)
Value< BR>Value\nValue
And I would like to see the following in the annotation label:
Value
Value
Value
Any help would be very much appreciated.
... View more
12-06-2017
05:40 AM
At one of my customers slackalert is used to send messages based on alerts created based on service bus events.
I have also heard of customers who us it in stead of email alerting. The reasoning behind that is that not everybody has their office mail on their phone but they do have Slack installed.
I myself use Slack alerts for monitoring my home automation and my Linux systems.
... View more
12-06-2017
05:25 AM
@niketnilay I must say that I do prefer the one that uses id names since you can tailor each trellis that way in stead of forcing all trellis' to use the same dimensions
So I would use
#assignedID #subID div div {
Where:
assignedID is the ID you set in the chart/single tag
subID is "singlevalue" for single and the contents of the option "charting.chart" for the filler, marker and radial gauges
... View more
12-06-2017
03:46 AM
1 Karma
Yes, the space works too!
... View more
12-06-2017
03:17 AM
Okay, I finally fixed it.
In stead of using:
.facets-container>.viz-facet {
in the style section, I used
#singleValueTrellis #singlevalue div div {
and that worked.
Just make sure the first part is the same as the id you assign to the single
... View more
12-06-2017
01:58 AM
@niketnilay In which version of Splunk did you test this dashboard? I tried it in 6.6.2 and 7.0.1 but it does not resize the div's. The div containing the viz-facet class has the following style settings:
style="width: 260px; height: 146px;"
and not the expected 100px by 100px
(I did a copy and past of your dashboard)
... View more
09-28-2017
02:04 AM
In our environment, we noticed that the CIM setup screen is not showing up when accessed via a virtual desktop but when accessed from a physical desktop, the setup screen comes up as expected.
Could this be desktop resource related?
... View more
05-25-2017
11:27 PM
2 Karma
A silent install could only be achieved through a Shell script run as root.
In that script you should:
- Stop Splunk (if this is an update and if it is running, installing via RPM should take care of this as well)
- Install Splunk either via RPM or by extracting a TAR file (you will have to download either of these from the Splunk website at https://www.splunk.com/en_us/download/splunk-enterprise.html#tabs/linux
- Start Splunk as the splunk user, accepting the license and performing all update actions (if necessary) (for instance via this command: sudo -u splunk ". /opt/splunk/bin/setSplunkEnv; /opt/splunk/bin/splunk --answer-yes --no-prompt --accept-license" )
Now if you want to ensure Splunk starts at boot time, have a look at this page: https://docs.splunk.com/Documentation/Splunk/6.6.0/Admin/ConfigureSplunktostartatboottime
However, if your system uses systemd, have a look at this page: https://answers.splunk.com/answers/59662/is-there-a-systemd-unit-file-for-splunk.html
... View more
05-25-2017
10:52 PM
I downvoted this post because the question is for a silent install on linux but the answer points to a how-to for installing splunk on the Windows command line
... View more
03-30-2017
04:53 AM
Ok, that's great, and yes that is exactly what I want. But from your example, I can't figure out how to do that, I downloaded the app you refer to but in the alert html file, I don't see a password field.
... View more
03-30-2017
04:27 AM
This solution does not help me with my question. I need to be able to set the password in the custom page for my alert and have the password handled the same way as if it would have been set in the setup.xml file.
I know how to set it in the setup.xml and I know how to retrieve it from the python script but when a user creates an alert, there should be an option to enter a password as well to override the password that was set through the setup.xml.
... View more
03-29-2017
11:56 PM
In this dated, but certainly not outdated, blog post, an explanation is given on how to handle passwords from the setup.xml
I however need to handle passwords from the user interface for a custom alert (.html) Unfortunately, I have been unable to find how to do that in a similar way as with the setup.xml file.
Can anyone tell me how to do this?
Thanx.
... View more
11-02-2016
06:35 AM
I downvoted this post because this patch will cause the interface.sh script to work with rhel 7/centos 7 but the script will no longer work for lower versions
... View more
10-27-2016
10:34 PM
There was an error in line 3
| eval date_hour = (date_hour + hour_offset) * if(direction=="-",-1,1)
should have been
| eval date_hour = (date_hour + (hour_offset * if(direction=="-",-1,1))
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-10-2023
12:56 PM
|
Karma given to
